05 Building Block View
This chapter specifies Prism’s static structure. The structure is hierarchical:
-
The Whitebox Overall System (this section, immediately below) opens Prism — the single black box from section 3 — and decomposes it into three contained black boxes.
-
Level 2 (below) opens each of those three black boxes and decomposes it into components.
-
Level 3 (below) opens any component whose internal structure is architecturally significant.
The L2 decomposition is shown in the diagram below.
Prism, when opened, contains exactly three black boxes:
| Building Block | Responsibility |
|---|---|
uor-foundation |
Substrate. Owns the type-declaration vocabulary (including the shape proc-macros via an internal sub-crate, a Cargo packaging detail not exposed in the wiki); the four UOR-domain sealed types (Datum, Triad, Derivation, FreeRank); the trace and certificate wire-format types as data definitions; the mint primitives that are the cross-crate construction surface for the four UOR-domain types. Exposes HostTypes, HostBounds, ConstrainedTypeShape (carrying CYCLE_SIZE per ADR-032), Grounding, AxisExtension and AxisTuple (per ADR-030; the trait family for substrate-extension axis declarations — concrete axes such as HashAxis are emitted by Layer-3 sub-crates per ADR-031, with HashAxis from prism-crypto subsuming the prior Hasher trait), plus ResolverTuple and the eight ψ-chain resolver traits (NerveResolver<H>, ChainComplexResolver<H>, HomologyGroupResolver<H>, CochainComplexResolver<H>, CohomologyGroupResolver<H>, PostnikovResolver<H>, HomotopyGroupResolver<H>, KInvariantResolver<H>) plus the corresponding Has<Category>Resolver<H> marker traits and the ResolverCategory enum and MAX_RESOLVER_TUPLE_ARITY const per ADR-036 — the trait family for resolver-bound substrate operations carrying per-value content provision for ψ-Term variants per ADR-035. |
prism |
Prism runtime. Owns the pipeline runtime; the three Prism-mechanism sealed types (Validated, Grounded, Certified); the operation-declaration vocabulary; a standard library of pre-declared types. Closed under uor-foundation's vocabulary: every type prism exposes is derived from uor-foundation's type-declaration vocabulary; every operation declaration composes uor-foundation::PrimitiveOp discriminants. Re-exports uor-foundation's vocabulary so application authors import only prism. Declares the bounds uor-foundation MUST satisfy and the surface the application author MUST satisfy. Enforces the UORassembly contract bilaterally through the Rust type system (constraint TC-04). |
prism-verify |
Replay surface. Thin façade re-exporting prism's certify_from_trace and Certified, and uor-foundation's wire-format type definitions. Carries no implementation of its own. The verification machinery lives in prism's replay component; prism-verify exists so application users can depend on a minimal surface (Trace, Hasher, Certified<GroundingCertificate>, ReplayError) without dragging in the pipeline runtime or uor-foundation's full vocabulary (constraint TC-05). |
| Aspect | Specification |
|---|---|
| Purpose | Define Prism’s substrate: the type-declaration vocabulary, the four UOR-domain sealed types, the wire-format type definitions, and the mint primitives. This is the smallest crate that establishes what Prism’s UOR-domain values are; what Prism does with them is prism's concern. |
Interface (consumed by prism) |
The trait surface (HostTypes, HostBounds, ConstrainedTypeShape carrying CYCLE_SIZE per ADR-032, Grounding, AxisExtension and AxisTuple per ADR-030 — the substitution-axis surface for substrate-extension axis declarations; plus ResolverTuple and the eight ψ-chain resolver traits per ADR-036 — the resolver-bound substrate-operation surface for per-value content provision); the four UOR-domain sealed type definitions (Datum, Triad, Derivation, FreeRank); the wire-format type definitions (Trace, TraceEvent, Certificate, CertificateKind, GroundingCertificate, ContentAddress, ContentFingerprint); the public mint primitives (mint_datum, mint_triad, mint_derivation, mint_freerank, mint_product_witness, mint_coproduct_witness, mint_cartesian_witness); the shape_iri_registry module per ADR-057 (RegisteredShape, lookup_shape, __register_shape) collecting ConstrainedTypeShape impls at link time for ψ_1 NerveResolver’s bounded-recursive-shape resolution; the shape proc-macros via the internal proc-macro sub-crate, reached through prism's vocabulary re-exports; the axis! SDK macro per ADR-030 for declaring substrate-extension axis traits (concrete axis declarations such as HashAxis/TensorAxis/FheAxis/NumericAxis are emitted by Layer-3 sub-crates per ADR-031); the resolver! SDK macro per ADR-036 for declaring ResolverTuple impls (concrete resolver impls live in the application’s crate or in standard-library Layer-3 sub-crates per ADR-031); the register_shape! SDK macro per ADR-057 for link-time registration of ConstrainedTypeShape impls into shape_iri_registry (emitted alongside the SDK’s partition_coproduct! / partition_product! expansions that use recurse(<bound>):<T> operand markers). |
Interface (consumed by application author’s crate, indirectly through prism) |
The same surface, accessed through prism's re-exports and macro expansions. The application author does not depend directly on uor-foundation; they depend on prism, which re-exports the necessary foundation symbols and applies prism's UORassembly bounds to them. |
Interface (consumed by prism-verify) |
The wire-format type definitions only. prism-verify re-exports them so the application user’s verification code names them through prism-verify rather than reaching into uor-foundation directly. |
| Quality / performance characteristics |
#![no_std] by default. No allocation outside alloc-feature-gated paths. No runtime dispatch — all dispatch is resolved by the Rust toolchain at compile time. The crate contains no Prism runtime layer (constraint TC-01). The internal proc-macro sub-crate is compile-time only and is not subject to #![no_std]. |
| Aspect | Specification |
|---|---|
| Purpose | Provide the Prism runtime — the pipeline that produces sealed UOR-domain values, the seal regime over the three Prism-mechanism types, the replay machinery, the operation-declaration vocabulary, and a standard library of pre-declared types. Enforce the UORassembly contract bilaterally at compile time. Expose a single import surface for the application author so they need not name uor-foundation directly. |
| Interface (consumed by application author’s crate) | The PrismModel trait — the developer’s hylomorphism contract (Input, Output, Route, forward; section 8); the pipeline entry point (pipeline::run, used as the catamorphism PrismModel::forward is derived from); the operation-declaration vocabulary; the standard type library; re-exports of uor-foundation's type-declaration vocabulary (traits, the four UOR-domain sealed type definitions, the wire-format types, and the shape proc-macros). The author imports prism and writes their domain logic by implementing PrismModel for their application. |
Interface (consumed against uor-foundation) |
The bounds prism declares against uor-foundation's trait surface; the calls prism's pipeline makes to uor-foundation's mint primitives at the UOR-domain admission stages. If uor-foundation ever fails to satisfy prism's bounds, prism fails to compile against it; this is the foundation-side enforcement of UORassembly (constraint TC-04). |
Interface (consumed by prism-verify) |
Re-export source for certify_from_trace and Certified. prism-verify does not call prism at runtime; it re-exports the verification surface so the application user’s verification code names it through prism-verify. |
| Quality / performance characteristics |
#![no_std] by default (the pipeline runtime is #![no_std]-compatible). No allocation outside alloc-feature-gated paths. The pipeline runtime IS linked into the application author’s executable (per E7.2 deployment view); the runtime cost beyond uor-foundation's contribution is bounded and quantified in section 10. |
| Aspect | Specification |
|---|---|
| Purpose | Provide the application user (or a third party they trust) with a minimal verification surface. Re-export certify_from_trace and Certified from prism; re-export the wire-format types from uor-foundation. The application user’s verification code imports only prism-verify. |
| Interface (consumed by application user’s crate or a third party’s verifier crate) |
certify_from_trace(trace, hasher_instance) returning Certified<GroundingCertificate> or ReplayError. The associated wire-format types (Trace, TraceEvent, Certificate, etc.) re-exported from uor-foundation. The Certified type re-exported from prism. |
Interface (consumed against prism and uor-foundation) |
Re-export only. prism-verify carries no implementation; it depends on prism for the certify_from_trace implementation and the Certified type, and on uor-foundation for the wire-format type definitions. |
| Quality / performance characteristics |
#![no_std] by default. Replay performance scales with trace size. No cryptographic hash function is invoked during verification (constraint TC-05). No remote service is contacted. The verification executable runs locally on the application user’s hardware. |
| From | To | Interface | Direction |
|---|---|---|---|
prism |
uor-foundation |
Trait bounds, vocabulary re-exports, mint-primitive calls | Compile time + runtime. prism declares bounds against uor-foundation's trait surface; the pipeline calls uor-foundation's mint primitives at the Datum/Triad/Derivation/FreeRank admission stages. |
prism-verify |
prism |
certify_from_trace, Certified re-exports |
Compile time only. prism-verify re-exports the verification entry point and the Certified type; no runtime call from prism-verify into prism exists outside what the user’s code reaches transitively. |
prism-verify |
uor-foundation |
Wire-format type definition re-exports | Compile time only. prism-verify re-exports Trace, TraceEvent, Certificate, etc., so the user names them through prism-verify. |
| Application author’s crate | prism |
Single-import modeling surface | Compile time. The author imports prism and writes their domain logic against prism's surface (which re-exports uor-foundation's vocabulary). |
| Application user’s crate | prism-verify |
Verification surface | Compile time. The user (or third party) imports prism-verify and invokes certify_from_trace. |
| Application author’s executable | prism |
pipeline::run invocation |
Runtime. The compiled executable calls into prism's pipeline as a native function call. |
prism's pipeline |
uor-foundation's mint primitives |
Mint-primitive calls at UOR-domain admission stages | Runtime. Compile-time-resolved direct calls from the pipeline into the mint-primitive surface. |
There is no shared mutable state, no runtime registry, and no plugin mechanism between the three containers. All composition is accomplished by the Rust toolchain at compile time.
This section opens each of Prism’s three containers and decomposes it into components. The L3 component diagrams are embedded with each container’s sub-section.
uor-foundation is the substrate. It contains the type-declaration
vocabulary, the four UOR-domain sealed types, the wire-format type
definitions, the mint primitives, and the internal proc-macro sub-crate
that hosts the shape macros.
| Component | Responsibility |
|---|---|
enforcement |
The sealed-type construction surface for the four UOR-domain types. Contains the crate-internal constructors for Datum, Triad, Derivation, FreeRank. Sub-modules: resolver (foundation-side Hasher contract); calibrations (binds substitution-axis selections to capacity bounds carried by the application’s selected HostBounds); transcendentals (foundation-fixed wire-format constants; capacity bounds are not foundation-fixed — see ADR-018); combinators (composition of UOR-domain values along the principal data path; the combinators for the three Prism-mechanism types relocate to prism's seal regime). Sealing (constraint TC-02) for these four types is enforced by making constructors pub(crate) to uor-foundation; cross-crate construction goes through the mint primitives. |
mint primitives |
The cross-crate construction surface. Public functions (mint_datum, mint_triad, mint_derivation, mint_freerank, mint_product_witness, mint_coproduct_witness, mint_cartesian_witness) that take type-level-validated inputs and internally call enforcement's pub(crate) constructors of the four UOR-domain sealed types. The architectural commitment — not a Rust-language access restriction — is that prism's pipeline is the only sanctioned caller of these primitives (ADR-016). |
bridge |
The author-implemented trait surface and the wire-format data definitions. Hosts ConstrainedTypeShape, Grounding, the observable trait surface (including the closed Observable taxonomy with seven internally-derived categories plus observable:AxisProjectionObservable per ADR-038 for axis-realized admission relations), the closed BoundShape catalogue of 7 individuals (EqualBound, LessEqBound for integer-valued observables, GreaterEqBound, RangeContainBound, ResidueClassBound, AffineEqualBound, LexicographicLessEqBound for byte-sequence-valued observables per ADR-040), the certificate type definitions (Certificate, CertificateKind, GroundingCertificate, cert:InhabitanceCertificate, cert:InhabitanceImpossibilityCertificate per ADR-039, ContentAddress, ContentFingerprint, Hasher), the proof type definitions (proof:InhabitanceImpossibilityWitness per ADR-039), the trace type definitions (Trace, TraceEvent, trace:InhabitanceSearchTrace per ADR-039), the resolver façades — including the homology-bridge Handle/Record/Resolved triplets that the eight ψ-chain resolver traits per ADR-036 (NerveResolver<H>, ChainComplexResolver<H>, HomologyGroupResolver<H>, CochainComplexResolver<H>, CohomologyGroupResolver<H>, PostnikovResolver<H>, HomotopyGroupResolver<H>, KInvariantResolver<H>) and their Null* resolver-absent baselines build on, plus the ResolverTuple trait and the Has<Category>Resolver<H> marker traits per ADR-036, and the ResolverCategory enum. This is the surface that prism declares bounds against (constraint TC-04, ADR-007). prism-verify re-exports the wire-format type definitions from this component. |
kernel |
The substitution-axis machinery. Contains the trait definitions for HostTypes, HostBounds, the address algebra, the carry algebra, the convergence machinery, and the operad surface that the principal data path uses. Substitution along the HostTypes and HostBounds axes is performed by the application author selecting concrete types that satisfy this component’s traits (ADR-007). The convergence machinery is the ontology-derived kernel::convergence namespace (Space::Kernel; IRI https://uor.foundation/convergence/) declaring the Hopf convergence tower: four ConvergenceLevel<H> instances at division-algebra dimensions {1, 2, 4, 8} (R, C, H, O — the four normed division algebras), each carrying a HopfFiber<H> (fiber spheres {S⁰, S¹, S³, S⁷}), a Betti signature, and a characteristic identity (existence, feedback, choice, self-reference); a ConvergenceResidual<H> (the persistent β_{2^k−1} = 1 Betti number at each level); and CommutativeSubspace<H> / AssociativeSubalgebra<H> for pairwise- and triple-interaction convergence (the U(1) ⊂ SU(2) and H ⊂ O subspace selections). The namespace is @generated from the UOR ontology and ships Null* resolver-absent baselines per the foundation’s orphan-closure discipline. ADR-059 commits this tower as the operator-geometry-coordinate codomain stratification of κ-derivation (ADR-058). |
primitives |
The primitive-operation catalog. Defines the closed set of primitive operations a Prism implementation provides: bit-rotation, content-comparison, depth-projection, integer-handling, lookup, observable-arithmetic. Components elsewhere in the foundation reference primitives by PrimitiveOp discriminant; primitives themselves are pure, total, and sealed. |
user |
The application-author-facing type-construction surface. Contains the morphism, state, and type-witness scaffolds that the shape proc-macros emit code against. The author’s ConstrainedTypeShape impls and Grounding impls land in this component’s surface. |
product_shape!, coproduct_shape!, cartesian_product_shape!, output_shape!, ShapeArgs parser |
Procedural macros and their shared input parser. Live in uor-foundation's internal proc-macro sub-crate (a Cargo packaging detail; not exposed in the wiki as a separate container). product_shape!, coproduct_shape!, and cartesian_product_shape! emit ConstrainedTypeShape impls and the corresponding mint_*_witness helpers for input/intermediate shapes; they also emit IntoBindingValue impls (per ADR-023) so the resulting shapes can flow through pipeline::run_route's input-binding mechanism. output_shape! (per ADR-027) emits ConstrainedTypeShape, __sdk_seal::Sealed, GroundedShape, and IntoBindingValue impls together for application-declared custom Output shapes used as PrismModel::Output. Authors reach the macros through prism's vocabulary re-exports. |
The components form a layered structure. kernel and primitives are
the foundation’s lowest layer (no internal dependencies on other
foundation components); bridge and user build on them; enforcement
references bridge for its wire-format type definitions;
mint primitives build on enforcement. The sealing discipline
(constraint TC-02) for the four UOR-domain types is concentrated in
enforcement; cross-crate construction is mediated by
mint primitives.
prism is the Prism runtime. It contains the pipeline, the three
Prism-mechanism sealed types, the replay machinery, the
operation-declaration vocabulary, the standard type library, and the
vocabulary re-exports of uor-foundation.
| Component | Responsibility |
|---|---|
pipeline |
The principal data path implementation. Provides pipeline::run, the singular function that consumes a Validated<CompileUnit, Phase> and produces a Grounded<T> plus a Trace. Constraint TC-03 establishes that this is the only path from input to Grounded<T>; the pipeline component is the sole implementation of that path. The Datum admission stage calls uor-foundation's mint_datum primitive; the Triad/Derivation/FreeRank construction stages call the corresponding mint primitives. Also provides pipeline::run_route<'a, H, B, A, M, R>(input, &resolvers) (ADR-022 D5 + ADR-036; lifetime + const-generic-parametric per ADR-060), the higher-level entry point that constructs the CompileUnit from M::Route (via <M::Route as FoundationClosed>::arena_slice()) and the input value (per ADR-060 the route input is the &'a [u8] source directly, carried as a TermValue::Borrowed; the pre-0.5.0 fixed ROUTE_INPUT_BUFFER_BYTES stack buffer is removed), threading the ResolverTuple (resolvers per ADR-036) through the catamorphism’s evaluation environment for resolver-bound ψ-Term consultation. The signature takes no axes value parameter — axis methods are type-associated and invoked through <A as Hasher>::initial() per the A: AxisTuple + Hasher substrate parameter per ADR-030 + ADR-036. pipeline::run evaluates the Term tree as a structural fold per ADR-029’s per-variant fold-rules across all twenty-one Term variants; the catamorphism’s terminal value is the Output shape’s bytes, carried in the Grounded's value payload as a source-polymorphic TermValue (Inline / Borrowed / Stream per ADR-060) accessible via output_bytes() (ADR-028). Per ADR-060 the output carries no fixed ROUTE_OUTPUT_BUFFER_BYTES ceiling (unbounded outputs flow as TermValue::Stream); the unrolling threshold <B as HostBounds>::FOLD_UNROLL_THRESHOLD per ADR-037 governs the macro’s lowering choice for fold_n declarations (ADR-026 G14). |
seal regime |
The pub(crate) constructors for the three Prism-mechanism sealed types: Validated, Grounded, Certified. Reachable from outside prism only via pipeline::run return values or via the replay component’s certify_from_trace. Sealing (constraint TC-02) for these three types is enforced by Rust’s visibility rules; there is no token, no checksum, no runtime sentinel. |
replay |
Houses certify_from_trace. Takes a Trace and a Hasher instantiation; performs structural validation of the trace events; passes the trace’s content fingerprint through unchanged; returns either Certified<GroundingCertificate> or ReplayError. Constructs Certified through the seal regime; calls no Hasher and no decider (constraint TC-05). Exposed publicly so prism-verify can re-export it. |
PrismModel |
The user-facing hylomorphism contract (section 8, PrismModel). Carries three associated types — Input, Output, Route — and one method, forward(input: Input) → Result<Grounded<Output>, PipelineFailure>. The Route bound is closure under foundation vocabulary: every node in the route’s Term::Application chain is a foundation-vocabulary item, checked at the application’s compile time by UORassembly (TC-04, ADR-013). forward is implemented by the catamorphism into pipeline::run's carrier (section 8, Foundation as a Signature Category); the application author does not write its body. PrismModel is the developer’s expression of the catamorphism + anamorphism pair uor-foundation formalizes as a hylomorphism with verifiable round-trip: the same content, surfaced as a Rust trait the author implements, with Real-Time Inference as the framing the author reads (ADR-020). |
operation declaration |
The vocabulary application authors use to declaratively express operations. prism ships the vocabulary, not operations themselves. Operation declarations compose uor-foundation::PrimitiveOp discriminants (closure under uor-foundation, ADR-013) under the seven prism-layer operators (compose, parallel_compose, fold_n, tree_fold, first_admit, partition_product, partition_coproduct; ADR-026). The vocabulary provides combinators, type-level constraints, and witnessing scaffolds. The SDK proc-macros that surface the vocabulary are: prism_model! for declaring whole PrismModel impls from a closure-bodied route function (ADR-022 D3, closure-body grammar G1–G29 per ADR-022 D3 + ADR-026 + ADR-033 + ADR-035); verb! for declaring named, reusable compositions of prism operators applied to substrate primitives within an implementation (ADR-024); use_verbs! for importing verbs from another implementation crate, gated on the imported crate’s seal regime (ADR-024). The verb-graph acyclicity check (closure under foundation primitives ∪ own-implementation verbs ∪ imported verbs; no cycles through non-recurse operators) is performed by verb! at each invocation and by prism_model! over the model’s whole route. |
standard type library |
Pre-declared types built from uor-foundation's type-declaration vocabulary. Available to application authors as a starting point for common shapes (e.g., bounded integers with specific calibrations, common product/coproduct combinations). Every standard type is expressible solely through the same vocabulary the author would use directly; the standard library is convenience, not capability. The standard library decomposes by uor-foundation's shape primitives — scalar (ring-typed), cartesian (independent homogeneous sites), product (heterogeneous), coproduct (alternation), host-substituted (via HostTypes axis slots). Each standard type is a canonical UOR-address mapping for its shape: its IRI is content-deterministic in its constraint declaration, and two applications using the same standard type produce values addressing identically (ADR-017). Per ADR-061, the standard type library also carries the five κ-label composition shapes — G2ProductShape<N> (binary, the G₂ product), F4QuotientShape<N>, E6FiltrationShape<N>, E7AugmentationShape<N>, and E8EmbeddingShape<N> (unary; the F₄/E₆/E₇/E₈ categorical operations on the Atlas image inside E₈ per ADR-059) — each parametric over the component-label byte width, through which a content-addressing realization composes N component κ-labels into a single composed κ-label. The catalog is published in prism's crate documentation, not specified in this wiki. |
vocabulary re-exports |
Re-exports of uor-foundation's type-declaration vocabulary so the author imports only prism. Includes: ConstrainedTypeShape (carrying CYCLE_SIZE per ADR-032), Grounding, HostTypes, HostBounds, AxisExtension and AxisTuple (per ADR-030; the substitution-axis surface for substrate-extension axis declarations including the prism-crypto-declared HashAxis per ADR-031 that subsumes the prior Hasher trait), ResolverTuple and the eight ψ-chain resolver traits (NerveResolver<H>, ChainComplexResolver<H>, HomologyGroupResolver<H>, CochainComplexResolver<H>, CohomologyGroupResolver<H>, PostnikovResolver<H>, HomotopyGroupResolver<H>, KInvariantResolver<H>) plus the Has<Category>Resolver<H> marker traits and the ResolverCategory enum and MAX_RESOLVER_TUPLE_ARITY const (per ADR-036), IntoBindingValue (ADR-023), GroundedShape (ADR-027); the four UOR-domain sealed type definitions (Datum, Triad, Derivation, FreeRank); the wire-format types (Trace, TraceEvent, Certificate, etc.); the shape proc-macros (product_shape!, coproduct_shape!, cartesian_product_shape!, output_shape!) from uor-foundation's internal proc-macro sub-crate; the axis! SDK macro per ADR-030; the resolver! SDK macro per ADR-036; the Term enum (twenty-one variants per ADR-022 D3 + ADR-029 + ADR-030 + ADR-033 + ADR-034 + ADR-035 — the original nine plus AxisInvocation, ProjectField, FirstAdmit, and the nine ψ-chain variants Nerve, ChainComplex, HomologyGroups, Betti, CochainComplex, CohomologyGroups, PostnikovTower, HomotopyGroups, KInvariants) and the PrimitiveOp discriminants (the canonical catalog at any committed snapshot per ADR-013/TR-08). |
The components form a layered structure. vocabulary re-exports is the
lowest layer (no internal dependencies). pipeline and replay both
build on seal regime (to construct the three Prism-mechanism sealed
types) and on vocabulary re-exports (to name uor-foundation's
vocabulary). operation declaration and standard type library are
author-facing layers that build on vocabulary re-exports. The seal
regime is the concentration of sealing discipline for the three
Prism-mechanism types, parallel to uor-foundation's enforcement for
the four UOR-domain types. PrismModel sits at the top of the runtime
stack: it composes pipeline (forward direction), replay (inverse
direction), seal regime (the fixed-point sealing), and
vocabulary re-exports (the route’s term-tree primitives) into the
single trait the application author implements. An author who implements
PrismModel does not call pipeline::run directly; the trait’s
forward method is implemented by the catamorphism prism derives from
the Route associated type.
prism's #![feature(generic_const_exprs)] opt-in is required because
the emitted ConstrainedTypeShape impls (emitted by the shape
proc-macros that live in uor-foundation's internal proc-macro
sub-crate) reference <H as HostBounds>::CAP at array-size positions.
This is the only Rust nightly feature prism depends on, and it is
required for the substitution-axis allocation in ADR-007 to function.
prism-verify is the smallest of Prism’s three containers. It is a thin
façade re-exporting prism's certify_from_trace and Certified, and
uor-foundation's wire-format type definitions. It carries no
implementation.
| Component | Responsibility |
|---|---|
certify_from_trace re-export |
The user-facing entry point. A re-export of prism::replay::certify_from_trace. Takes a Trace and a Hasher instantiation; returns Certified<GroundingCertificate> or ReplayError. The implementation lives in prism's replay component (constraint TC-05). |
Re-exports |
Re-exports split between two sources. From prism: the Prism-mechanism sealed type Certified (and any associated error variants). From uor-foundation: the wire-format types (Trace, TraceEvent, Certificate, CertificateKind, GroundingCertificate, ContentAddress, ContentFingerprint, Hasher, BindingsTableError, ReplayError, PrimitiveOp), the HostBounds trait surface (whose associated constants carry every capacity bound — section 2, ADR-018), and the wire-format version constant (TRACE_REPLAY_FORMAT_VERSION). |
The two components produce an extremely small public surface. The
application user’s verification code typically consists of a single call
to certify_from_trace against a deserialized Trace, with the user’s
crate selecting the matching Hasher instantiation. Because
prism-verify re-exports both the verification entry point and the
wire-format types the user touches, the user names nothing in prism or
uor-foundation directly.
The round-trip property the verifier provides is bit-identical: for
every Grounded<T> value g that the application author’s executable
produced through pipeline::run, the call
certify_from_trace(&g.derivation().replay()).certificate() returns the
same certificate as g.certificate(). The verifier is thus not a
re-derivation in the sense of recomputing — it is a structural
revalidation that confirms the trace’s content matches what would have
been produced.
This section zooms into the components from Level 2 whose internal structure is architecturally significant. Four components warrant Level 3 decomposition because the corresponding constraints (TC-02, TC-03, TC-05) impose normative structure on their internals.
The enforcement component implements the sealing discipline for the
four UOR-domain sealed types. Its internal structure is:
| Sub-component | Responsibility |
|---|---|
| Sealed-type module | Defines the four UOR-domain sealed types (Datum, Triad, Derivation, FreeRank). Each is a pub struct whose fields are pub(crate); combined with the absence of public constructor functions, this makes the types nameable by external code but unconstructable by it. |
| Crate-internal constructors |
pub(crate) fn constructors for each UOR-domain sealed type, accessible only to other modules within uor-foundation. The crate-internal scope is what enforces TC-02 within uor-foundation. Cross-crate construction is mediated by the separate mint primitives component. |
enforcement::resolver |
Resolver façades implementing the foundation-side of the substitution-axis contract for Hasher. Any Hasher impl the application author selects must satisfy the trait this sub-component defines. |
enforcement::calibrations |
Calibration types that bind the substitution-axis selections to the capacity bounds carried by the application’s selected HostBounds. The fingerprint output width range, the algebraic-level bit-width ceiling, and any further HostBounds-borne capacity surface here for use along the principal data path; foundation does not establish these capacities globally (ADR-018). |
enforcement::transcendentals |
Foundation-level constants of the wire format that are fixed by the format itself rather than carried by any substitution axis. The trace wire-format version (TRACE_REPLAY_FORMAT_VERSION) is foundation-fixed because cross-implementation interoperability requires a single shared format identifier. Capacity bounds are not foundation-fixed; they are carried by the application’s selected HostBounds (ADR-018). |
enforcement::combinators |
Combinator surface for composing values of the four UOR-domain types along the principal data path. The combinators for the three Prism-mechanism types relocate to prism's seal regime; this sub-component handles only UOR-domain composition. |
The seal for the four UOR-domain types is enforced exclusively by Rust’s
visibility rules within uor-foundation. Cross-crate construction goes
through the mint primitives component, which is a separate
cross-crate-public surface that the architectural commitment in ADR-016
reserves for prism's pipeline.
The mint primitives component is the cross-crate construction surface
for the four UOR-domain sealed types. It is the only path through which
code outside uor-foundation can produce values of Datum, Triad,
Derivation, or FreeRank.
| Mint primitive | Constructs | Inputs | Internal call |
|---|---|---|---|
mint_datum |
Datum |
Host bytes that have already passed the author’s Grounding impl |
pub(crate) constructor of Datum in enforcement
|
mint_triad |
Triad |
Three values that satisfy the Triad shape constraint |
pub(crate) constructor of Triad in enforcement
|
mint_derivation |
Derivation |
A precursor and a typed transition witness |
pub(crate) constructor of Derivation in enforcement
|
mint_freerank |
FreeRank |
A natural-number rank witness |
pub(crate) constructor of FreeRank in enforcement
|
mint_product_witness, mint_coproduct_witness, mint_cartesian_witness
|
Type-level witness values for the corresponding shape proc-macro | Compile-time-validated identifier tokens | Internal helpers used by the emitted code from the shape proc-macros |
Each mint primitive is a pub fn taking type-level-validated inputs.
The architectural commitment of ADR-016 is that prism's pipeline is
the only sanctioned caller; this is not a Rust-language access
restriction (any caller with uor-foundation in its dependency graph
can syntactically call these functions), but it is the normative
architectural commitment Prism makes. Conformance to this commitment is
observable: a Prism implementation in which any code other than
prism's pipeline calls a mint primitive is not a Prism implementation.
The pipeline component implements the principal data path. Constraint
TC-03 specifies the path’s singularity; the component’s internals show
the staged transitions through which an input becomes a Grounded<T>.
| Stage | Input | Output | Notes |
|---|---|---|---|
| Datum admission | Host bytes plus a Grounding impl |
Datum |
The Grounding impl interprets host bytes as a candidate. The pipeline calls uor-foundation::mint_datum with the candidate; admission may fail with a typed impossibility witness rather than producing a Datum. |
| CompileUnit construction |
Datum plus a ConstrainedTypeShape impl |
Validated<CompileUnit, Phase> (in-progress) |
CompileUnitBuilder accumulates the constraints declared by the ConstrainedTypeShape impl; the result is a partial Validated value at intermediate phases. Validated is constructed by prism's seal regime. |
| Validation |
Validated<CompileUnit, Phase> at intermediate phases |
Validated<CompileUnit, FinalPhase> |
The validation phase confirms all ConstrainedTypeShape constraints are satisfied. Validation may fail with a typed ShapeViolation; Validated at the final phase is only constructible if every constraint passed. |
| Pipeline run | Validated<CompileUnit, FinalPhase> |
Grounded<T> plus Trace
|
pipeline::run is the singular function. The stage produces both the sealed Grounded<T> and the Trace simultaneously; the trace is constructed from the same data the Grounded<T> carries, so replayability (TC-05) holds by construction. Grounded is constructed by prism's seal regime. |
| Certificate emission | Grounded<T> |
Certified<GroundingCertificate> |
The certificate is a structured statement about the Grounded<T> value. Its content fingerprint is computed by the substituted Hasher at this stage, exactly once. Certified is constructed by prism's seal regime. |
Each stage’s transition is a function in pipeline whose input and
output types are both sealed; the stages cannot be invoked out of order
because the input type of stage N+1 is the output type of stage N, and
there is no constructor for stage N+1’s input outside the seal regime
(for the three Prism-mechanism types) or outside the mint primitives
(for Datum).
The seal regime and replay components together implement the sealing
discipline for the three Prism-mechanism types and the verification
surface that constraint TC-05 mandates.
| Sub-component | Responsibility |
|---|---|
Sealed-type module (in seal regime) |
Defines the three Prism-mechanism sealed types (Validated, Grounded, Certified). Each is a pub struct whose fields are pub(crate); combined with the absence of public constructor functions, this makes the types nameable by external code but unconstructable by it. |
Crate-internal constructors (in seal regime) |
pub(crate) fn constructors for each Prism-mechanism sealed type, accessible only to other modules within prism. The crate-internal scope is what enforces TC-02 for these three types. |
Phase-witness combinators (in seal regime) |
Combinators for advancing Validated<T, Phase> through phases, for promoting Grounded through certificate emission, and for composing Certified along certificate-of-certificate paths. These are the only public composition operations on the three sealed types; ad-hoc composition is unavailable because the underlying field accessors are crate-internal. |
replay::certify_from_trace |
The verification entry point. Constructs Certified<GroundingCertificate> from a Trace and a Hasher (whose identifier matches the trace) by walking the trace’s TraceEvent sequence. Calls the seal regime’s crate-internal Certified constructor; calls no Hasher invocation and no decider invocation. Exposed publicly so prism-verify can re-export it. |
replay::structural_validator |
Walks the TraceEvent sequence, confirming each event is well-typed against the next. Used by certify_from_trace; not directly exposed. |
The three Prism-mechanism types are reachable from outside prism ONLY
via two paths:
-
pipeline::runreturn values (the (Grounded, Trace, Certified) tuple at the end of the principal data path). -
certify_from_trace(whichprism-verifyre-exports for the application user).
There is no third path. A Prism implementation in which any code outside
prism constructs a Validated, Grounded, or Certified value by
any other means is not a Prism implementation.
These two sub-components together specify the data-definition types that
constraint TC-05 (replayability without deciders or hashing) binds. They
live in uor-foundation::bridge; prism's pipeline produces instances
of them; prism-verify re-exports their definitions for the user. They
are data definitions, not active code: the wire format they specify is
normative and is consumed by both producers (prism) and consumers
(prism-verify re-export, then user code).
| Sub-component | Responsibility |
|---|---|
bridge::trace::Trace |
The trace value type. Contains a sequence of TraceEvent values, the ContentFingerprint carried by the trace (computed once by the author’s Hasher at mint time), the trace format version (TRACE_REPLAY_FORMAT_VERSION), and the trace event count (bounded by the trace event-count ceiling carried by the application’s selected HostBounds). The wire format is specified normatively in section 8. |
bridge::trace::TraceEvent |
The discriminated union of trace event variants. Each variant records one stage transition along the principal data path. The verifier’s structural validation walks this sequence; the validation succeeds if the event sequence forms a well-typed path through the staged transitions. |
bridge::cert::Certificate |
The certificate value type. Wraps CertificateKind and the content addresses (ContentAddress) the certificate vouches for. The certificate is what Certified<C> (a prism sealed type) seals. |
bridge::cert::CertificateKind |
The discriminated union of certificate variants. GroundingCertificate is the variant produced by pipeline::run; other variants exist for certificate-of-certificate composition along the principal data path. |
bridge::cert::ContentFingerprint |
The substitution-axis-substituted content address. Its byte width is the byte-width range carried by the application’s selected HostBounds; the substituted Hasher selects the actual width within that range. |
bridge::cert::ContentAddress |
The fixed-format content address used inside certificates. Wraps a ContentFingerprint with the metadata necessary for cross-implementation interoperability (e.g., the Hasher-identifier the fingerprint was computed by). |
The wire format of Trace (specified in section 8) is what makes
cross-party replay work: the trace is a sequence of TraceEvent values
plus a ContentFingerprint; the verifier walks the sequence, confirms
each event is well-typed against the next, and emits a
Certified<GroundingCertificate> whose certificate matches the
original. No Hasher invocation occurs during this walk, because the
fingerprint is data carried by the trace, not data computed during
replay.